Entropic DDoS Detection for Quantum Networks

Abstract

Distributed Denial-of-Service (DDoS) attacks are a significant issue in classical networks. These attacks have been shown to impact the critical infrastructure of a nation, such as its major financial institutions. The possibility of DDoS attacks has also been identified for quantum networks. In this theoretical work, we introduce a quantum analogue of classical entropic DDoS detection systems and apply it in the context of detecting an attack on a quantum network. In particular, we examine DDoS attacks on a quantum repeater and harness the associated entanglement entropy for the detection system. Our results extend the applicability of quantum information from the domain of data security to the area of network security.

1. Introduction

A central aim of quantum information science is to design quantum systems that perform information tasks [1]. Prominent examples of such work involved deriving quantum analogues of classical information technologies and demonstrating an advantage by utilizing the quantum resource. For instance, the property of superposition is used by quantum models of computation to drastically outperform the best classical supercomputers on certain tasks [2,3]. Another example is the quantum analogues of classical communication networks which are simply referred to as quantum networks [4]. In such networks, quantum information can be teleported [5], notably to distances exceeding 1000 km [6]. Further protocols include secure key distribution which are predicated on the impossibility to copy quantum information [7].

Beyond this established work, a direction ahead is to design novel quantum information technologies by harnessing our understanding of the classical case. Our main result is to demonstrate progress in this area.

Distributed Denial-of-Service (DDoS) attacks are a significant issue in network security [8,9], and various methods have been developed to detect the attacks in classical networks. The possibility of DDoS attacks has also been identified for quantum networks [7,10,11,12]. In our theoretical work, we designed a detection system for such attacks that occur in this quantum setting.

2. Classical DDoS

In classical networks, information is transmitted in the form of data packets, and the role of directing this traffic is performed by routers. To initiate a DDoS flooding attack, many routers would direct packets from multiple attack nodes to a victim node. The intent behind this flood of traffic is to overload the victim node so that it becomes unresponsive to legitimate traffic.

DDoS attacks are rather frequent events [8,9], and their reach can extend into the critical infrastructure of a nation [13]. These include attacks on major financial institutions, such as banks [14,15] and exchanges [16].

Preventing a DDoS attack requires most essentially the ability to identify the attack traffic as early as possible [17]. To achieve this capability, detection systems have been designed using the Shannon entropy:

$$H\left(X\right)\equiv -\sum _i{p}_{i}log{p}_i,$$

(1)

where $p_i$ are the probabilities associated with random variable X, and logarithms are taken to base 2.

Reviews of such entropic approaches can be found in [9,17,18]. We briefly outline one of these methods [19].

A flow at a router is group of packets categorized as

$$f_{ij}(u_i,d_j,t)\equiv \{<u_i,d_j,t>|u_i\in U,d_j\in D\},$$

(2)

where $i,j\in {\mathbb{Z}}^{+}$, U is the set of the upstream routers, D denotes the set of destination addresses from the router, and t is the time stamp. Let $|f_{ij}(u_i,d_j,t)|$ represent the number of packets of flow $f_{ij}$ at time t. For a given time interval $\mathsf{\Delta }T$, the variation of the number of packets for a given flow is defined as

$$N_{ij}(u_i,d_j,t+\mathsf{\Delta }t)\equiv |f_{ij}(u_i,d_j,t+\mathsf{\Delta }T)|-|f_{ij}(u_i,d_j,t)|.$$

(3)

If $|f_{ij}(u_i,d_j,t)|=0$, then $N_{ij}(u_i,d_j,t+\mathsf{\Delta }T)$ is the number of packets of flow $f_{ij}$ that went through the router during time interval $\mathsf{\Delta }T$. The quantity

$$p_{ij}(u_i,d_j,t+\mathsf{\Delta }T)=\frac{N_{ij}(u_i,d_j,t+\mathsf{\Delta }T)}{{\sum }_{i=1}^{\infty }{\sum }_{j=1}^{\infty }{N}_{ij}(u_i,d_j,t+\mathsf{\Delta }T)},$$

(4)

gives the probability of the flow $f_{ij}$ over all flows at the router with

$$\sum _{i=1}^{\infty }\sum _{j=1}^{\infty }{p}_{ij}(u_i,d_j,t+\mathsf{\Delta }T)=1.$$

(5)

The computation of the Shannon entropy (1) at the router is obtained through

$$H\left(F\right)=-\sum _{i,j}{p}_{ij}(u_i,d_j,t+\mathsf{\Delta }T)log{p}_{ij}(u_i,d_j,t+\mathsf{\Delta }T),$$

(6)

where F is the associated random variable with respect to flows during $\mathsf{\Delta }T$. If the total number of flows is constrained to N, then (6) is rather simply

$$H\left(F\right)=H(p_1,p_2,\dots ,p_N)=-\sum _{i=1}^N{p}_{i}log{p}_i,$$

(7)

with $0\le H\left(F\right)\le logN$. The lower bound occurs when there is only one flow.

In order to model a DDoS attack, a number of assumptions are made. These are that there is no extraordinary change of traffic in a very short time for the non-attack case, the number of attack packets is at least an order of magnitude higher than that of normal flows, there is only one attack ongoing at a time, and the number of flows is stable for both non-attack and attack cases.

Suppose attack flows start passing through the router at $t=(n+1)\tau$; hence, $t=n\tau$ signifies the time at the router just before the attack. The respective distributions are

$$\begin{array}{ccc}& \{p_1^{(n+1)\tau }& ,p_2^{(n+1)\tau },\dots ,p_N^{(n+1)\tau }\},\hfill \end{array}$$

(8)

$$\begin{array}{ccc}& \{p_1^{n\tau }& ,p_2^{n\tau },\dots ,p_N^{n\tau }\}.\hfill \end{array}$$

(9)

A consequence of the assumptions is that $p_k^{n\tau }\ll p_k^{(n+1)\tau }$ for some k. Further reasoning with Jensen’s inequality leads to

$$-\sum _{i=1}^N{p}_i^{n\tau }log{p}_i^{n\tau }\gg -\sum _{i=1}^N{p}_i^{(n+1)\tau }log{p}_i^{(n+1)\tau }.$$

(10)

Expressing this in terms of the entropy (7) gives

$$H\left(F^{n\tau }\right)\gg H\left(F^{(n+1)\tau }\right).$$

(11)

The entropy at the router drops dramatically as soon as attack flows are passing through, thereby allowing for an ability to detect an attack as early as possible.

3. Quantum Networks

Quantum networks [4] generate entanglement over long distances. These entanglement flows are routed through devices known as repeaters [20,21], which perform entanglement swapping to connect two spatially entangled links into a longer entangled link.

To illustrate an instantiation of this task, we will utilize Bell states

$$|{\beta }_{xy}⟩=\frac{|0⟩\otimes |y⟩+{(-1)}^x|1⟩\otimes |\overline{y}⟩}{\sqrt{2}},$$

(12)

where the bar denotes negation and we have a choice between $xy=00,01,10,$ or 11. With respect to the computational basis states, the quantum information in the Bell state (12) takes the form

$$\left(\frac{\overline{y}}{\sqrt{2}},\frac{y}{\sqrt{2}},\frac{{(-1)}^{x}y}{\sqrt{2}},\frac{{(-1)}^x\overline{y}}{\sqrt{2}}\right).$$

(13)

Consider a quantum network which has to perform a routing task between two nodes. A request node needs to share a Bell state with a receiver node, with the constraint that the request node is unable to directly communicate with the receiver node. Despite the apparent difficulty, this task can be accomplished through the use of a quantum repeater located at another node.

We start by generating Bell pairs at both the request node (qubits A and B) and the repeater node (qubits C and D). One qubit (B) of the request pair reaches the repeater to be Bell projected with a qubit (C) at the repeater.

The joint state can be written as

$$\begin{array}{cc}\hfill & |\mathrm{Request}⟩\otimes |\mathrm{Repeater}⟩\equiv {|{\beta }_{00}⟩}_{A,B}\otimes {|{\beta }_{xy}⟩}_{C,D}\\ \hfill & =\frac{1}{2}({|{\beta }_{xy}⟩}_{A,D}\otimes {|{\beta }_{00}⟩}_{B,C})\\ & +{|{\beta }_{\overline{x}y}⟩}_{A,D}\otimes {|{\beta }_{10}⟩}_{B,C}\\ \hfill & +{(-1)}^x{|{\beta }_{x\overline{y}}⟩}_{A,D}\otimes {|{\beta }_{01}⟩}_{B,C}\\ \hfill & +{(-1)}^x{|{\beta }_{\overline{x}\overline{y}}⟩}_{A,D}\otimes {|{\beta }_{11}⟩}_{B,C}.\end{array}$$

(14)

The repeater performs a Bell state projection on $BC$. This returns one of four possible outcomes with consequences for $AD$:

$$\begin{array}{ccc}\hfill {|{\beta }_{00}⟩}_{B,C}& \to & {|{\beta }_{xy}⟩}_{A,D}\hfill \\ \hfill {|{\beta }_{01}⟩}_{B,C}& \to & {(-1)}^x{|{\beta }_{x\overline{y}}⟩}_{A,D}\hfill \\ \hfill {|{\beta }_{10}⟩}_{B,C}& \to & {|{\beta }_{\overline{x}y}⟩}_{A,D}\hfill \\ \hfill {|{\beta }_{11}⟩}_{B,C}& \to & {(-1)}^x|{\beta }_{\overline{x}\overline{y}}⟩.\hfill \end{array}$$

(15)

Depending on the outcome, the repeater applies a particular unitary operator to qubit D:

$$\begin{array}{cc}& (\mathbb{I}\otimes \mathbb{I}){|{\beta }_{xy}⟩}_{A,D},\\ & (\mathbb{I}\otimes {(-1)}^x{\widehat{\sigma }}_1){(-1)}^x{|{\beta }_{x\overline{y}}⟩}_{A,D},\\ & (\mathbb{I}\otimes {(-1)}^y{\widehat{\sigma }}_3){|{\beta }_{\overline{x}y}⟩}_{A,D},\\ & (\mathbb{I}\otimes {(-1)}^{x+y}{\widehat{\sigma }}_3{\widehat{\sigma }}_1){(-1)}^x{|{\beta }_{\overline{x}\overline{y}}⟩}_{A,D},\end{array}$$

(16)

where ${\widehat{\sigma }}_1=|0⟩⟨1|+|1⟩⟨0|,{\widehat{\sigma }}_2=-i|0⟩⟨1|+i|1⟩⟨0|$ and ${\widehat{\sigma }}_3=|0⟩⟨0|-|1⟩⟨1|$. Afterwards, the non-projected qubit (D) of the repeater pair leaves towards the destination node. This results in the desired output of having state ${|{\beta }_{xy}⟩}_{A,D}$ shared between the request node and receiver.

We want to view this procedure in terms of the von Neumann quantum entropy [1], which is defined as

$$S\left(\rho \right)\equiv -\mathrm{Tr}(\rho log\rho ),$$

(17)

where $\rho$ is a density operator. The entropy is zero if and only if it is a pure state. For an arbitrary composite system with subsystems K and L, the joint and conditional entropy are

$$\begin{array}{cc}\hfill S\left({\rho }_{KL}\right)& \equiv -\mathrm{Tr}({\rho }_{KL}log{\rho }_{LK}),\end{array}$$

(18)

$$\begin{array}{cc}\hfill S\left({\rho }_K\right|{\rho }_L)& \equiv S\left({\rho }_{KL}\right)-S\left({\rho }_L\right),\end{array}$$

(19)

where ${\rho }_K={\mathrm{Tr}}_L\left({\rho }_{KL}\right)$ and ${\rho }_L={\mathrm{Tr}}_K\left({\rho }_{KL}\right)$. Suppose ${\rho }_{KL}$ is a pure state; then, ${\rho }_{KL}$ is entangled if and only if

$$S\left({\rho }_K\right|{\rho }_L)<0.$$

(20)

In this case, the entropy of either subsystem, $S\left({\rho }_K\right)$ or $S\left({\rho }_L\right)$, is referred to as the entanglement entropy.

In the repeater, the density operator is

$${\rho }_{C,D}={|{\beta }_{xy}⟩}_{B,C}{⟨{\beta }_{xy}|}_{B,C},$$

(21)

and the associated conditional entropy is

$$S\left({\rho }_C\right|{\rho }_D)=S\left({\rho }_{C,D}\right)-S\left({\rho }_D\right)=0-1=-1,$$

(22)

which indicates entanglement (20) as expected. Note that at the time before projection, qubits A and D are not entangled

$$S\left({\rho }_A\right|{\rho }_D)=S\left({\rho }_{A,D}\right)-S\left({\rho }_D\right)=2-1=1.$$

(23)

For the output state, the density operator takes the form

$${\rho }_{A,D}={|{\beta }_{xy}⟩}_{A,D}{⟨{\beta }_{xy}|}_{A,D},$$

(24)

and the associated conditional entropy is

$$\begin{array}{ccc}\hfill S\left({\rho }_A\right|{\rho }_D)& =& S\left({\rho }_{A,D}\right)-S\left({\rho }_D\right)\hfill \\ & =& 0-1=-1,\hfill \end{array}$$

(25)

signifying entanglement, with a loss of it in

$$\begin{array}{ccc}\hfill S\left({\rho }_C\right|{\rho }_D)& =& S\left({\rho }_{C,D}\right)-S\left({\rho }_D\right)\hfill \\ & =& 2-1=1.\hfill \end{array}$$

(26)

In terms of the joint entropy, just before projection (22), we see that $S\left({\rho }_{C,D}\right)=0$, which specifies a pure state. After projection (26), we have that $S\left({\rho }_{C,D}\right)=2$, which signifies missing information in $CD$. Part of that missing information moved, as described by the updated entropy $S\left({\rho }_{A,D}\right)=0$ in the output ${|{\beta }_{xy}⟩}_{A,D}$.

4. Quantum DDoS

Quantum networks can also experience DDoS attacks [10,22], which poses a significant threat to its quantum key distribution protocols [7,11]. Given that quantum repeaters have a maximum session capacity [23], we consider DDoS attacks on a repeater where service requests exceed that maximum capacity.

The entanglement entropy will be used to formulate a DDoS detection system analogous to the classical case (11). To derive this, we utilize various aspects of the material in [24] towards our specific application.

Our model starts with the request node generating ${|{\beta }_{00}⟩}_{A,B}$, with qubit B being sent to the repeater. The repeater generates ${|{\beta }_{00}⟩}_{C,D}$, which can be viewed as an instantiation of ${|{\beta }_{xy}⟩}_{C,D}$.

We consider the quantities before the projection. The total system is ${\rho }_{A,B,C,D}$, which denotes

$${|{\beta }_{00}⟩}_{A,B}{|{\beta }_{00}⟩}_{C,D}{⟨{\beta }_{00}|}_{A,B}{⟨{\beta }_{00}|}_{C,D},$$

(27)

and the subsystem held at the repeater is ${\rho }_{B,C,D}$, as it excludes ${\rho }_A$. Given qubits C and D are jointly in a pure state, we have that

$$S\left({\rho }_{B,C,D}\right)=S\left({\rho }_B\right)=1.$$

(28)

The qubit B is maximally mixed, since it is entangled with qubit A in a Bell state. Thus, the entanglement entropy of qubit A before the projection equates to

$$S\left({\rho }_A\right)=S\left({\rho }_{B,C,D}\right).$$

(29)

We take the partial trace to obtain the density operator for qubit D

$${\rho }_D={\mathrm{Tr}}_{ABC}\left({\rho }_{A,B,C,D}\right).$$

(30)

We have that $S\left({\rho }_D\right)=1$, since it is entangled with ${\rho }_C$.

The entanglement entropy forms a crucial role for a repeater session. A successful session occurs when the entanglement is swapped (15). The swapping is successful only if the repeater uses some rank-one orthogonal projectors ${\Pi }_i$ such that no matter what outcome occurs at the repeater on qubits B and C, the value of the entanglement entropy of ${\rho }_A$ before projection must equal the value of the entanglement entropy of ${\rho }_A$ after projection.

We proceed to examine the quantities after the projection. If the repeater obtains outcome i, then the density operator of D is

$${\rho }_{D_i}=\frac{1}{p_i}{\mathrm{Tr}}_{ABC}\left({\Pi }_i{\rho }_{A,B,C,D}\right),$$

(31)

where $p_i$ is the associated Born probability. Given

$$\sum _i{\Pi }_i=\mathbb{I},$$

(32)

we have that

$${\rho }_D=\sum _i{p}_i{\rho }_{D_i}.$$

(33)

After measurement, qubits A and D are in a pure entangled state. The entanglement entropy of D equates to the entanglement entropy of A after projection

$$S\left({\rho }_{D_i}\right)=S\left({\rho }_A\right).$$

(34)

Using the crucial condition that a successful session requires the entropy before projection and entropy after projection of ${\rho }_A$ to equate, we can formulate relationships between the quantities before and after projection. Specifically, using (29) and (34), we obtain

$$S\left({\rho }_{D_i}\right)=S\left({\rho }_{B,C,D}\right),$$

(35)

and furthermore

$$S\left({\rho }_{B,C,D}\right)=S\left({\rho }_{D_i}\right)=\sum _i{p}_{i}S\left({\rho }_{D_i}\right).$$

(36)

Applying the concavity inequality [24] to (33) results in

$$S\left({\rho }_D\right)\ge \sum _i{p}_{i}S\left({\rho }_{D_i}\right).$$

(37)

Combining (36) and (37) gives

$$S\left({\rho }_{B,C,D}\right)=\sum _i{p}_{i}S\left({\rho }_{D_i}\right)\le S\left({\rho }_D\right).$$

(38)

Therefore, before the projection, one can predict that a successful session is possible when and only when

$$S\left({\rho }_{B,C}\right|{\rho }_D)=S\left({\rho }_{B,C,D}\right)-S\left({\rho }_D\right)\le 0.$$

(39)

A failed session will occur when $S\left({\rho }_{B,C}\right|{\rho }_D)>0$. For our specific case (27), we have that $S\left({\rho }_{B,C}\right|{\rho }_D)=0$, which implies a successful session ahead.

The capacity of the repeater is defined as the maximum number of sessions it can facilitate simultaneously, and this is directly related to the number of Bell pairs that can be stored in memory [23]. In our case, this would be the maximum number of copies of ${\rho }_{C,D}$ generated at a time to keep the service at full capacity. After that time, any unused Bell pairs get destroyed, and the system regenerates to full capacity at the next time point.

With respect to capacity, we modify our previous analysis to N copies of system ${\rho }_{A,B,C,D}$ for a large N. The repeater would perform a complete projective measurement on ${\left({\rho }_{B,C}\right)}^{\otimes N}$. In this case, all the entropies are multiplied by N. Hence, the condition (39) for sessions is maintained, and we can interpret it in terms of capacity.

In [24], it was shown that a negative conditional entropy in an entanglement-swapping protocol equals the number of left Bell pairs. Harnessing this reasoning in our quantum repeater scenario implies that if we have $S\left({\rho }_{B,C}\right|{\rho }_D)<0$ before the projection, then $-S\left({\rho }_{B,C}\right|{\rho }_D)$ is the number of Bell pairs left afterwards in the memory. It can be viewed as quantifying the unused capacity after the session requests have been fulfilled. If $S\left({\rho }_{B,C}\right|{\rho }_D)>0$, it not possible to carry out a session to begin with, and the system predicts an unresponsive service due to requests exceeding the capacity. Therefore, (39) can be used to model a DDoS attack.

To design a detection system, suppose a flood of attack requests reaches a repeater at specific time $t=(n+1)\tau$. We make the same assumptions about the network traffic of the attack requests as in the previous classical case. For example, here we also assume the number of attack requests is at least an order of magnitude higher than that of normal requests. The entropy of the requests at the repeater is quantified as

$$S\left({\rho }_B^{n\tau }\right)\ll S\left({\sigma }_B^{(n+1)\tau }\right),$$

(40)

where $\rho$ is used to label the systems involved prior to attack, and $\sigma$ denotes the systems involved in the attack (the superscripts signify the respective times). The repeater generates the same full capacity at each time point; hence,

$$S\left({\rho }_{C,D}^{n\tau ,n\tau }\right)=S\left({\sigma }_{C,D}^{(n+1)\tau ,(n+1)\tau }\right),$$

(41)

and with (40), we obtain

$$S\left({\rho }_{B,C,D}^{n\tau ,n\tau ,n\tau }\right)\ll S\left({\sigma }_{B,C,D}^{(n+1)\tau ,(n+1)\tau ,(n+1)\tau }\right).$$

(42)

From (41), we have that

$$S\left({\rho }_D^{n\tau }\right)=S\left({\sigma }_D^{(n+1)\tau }\right).$$

(43)

Combining this with (42) produces an entropic DDoS detection formula at the repeater

$$S\left({\rho }_{B,C}^{n\tau ,n\tau }\right|{\rho }_D^{n\tau })\ll S\left({\sigma }_{B,C}^{(n+1)\tau ,(n+1)\tau }\right|{\sigma }_D^{(n+1)\tau }).$$

(44)

The conditional entropies in (44) encode both the requests and the capacity, thereby providing a mechanism for early detection of a DDoS attack. In an attack, this entropy increases dramatically at the repeater, signifying a drastic reduction in capacity.

It is important to note that in this attack scenario, the capacity for service may still be available, in that (39) is still satisfied. What is of importance to the detection system (for early detection) is that there has been a drastic change in capacity, as expressed through (44). Hence, we use (44) to detect the attack. This line of reasoning follows from the classical system, and thus, in this work we have provided a quantum DDoS detection system that is analogous to the classical case (11).

5. Discussion

To address implementation, a large number of low-level design features need to be addressed. One issue is for the node to compute the quantum entropy using some subset of the network traffic. Various quantum algorithms for calculating entropy have been developed [25,26,27], and future work would involve integrating these methods for a refined detection system.

In classical networks, after detecting a DDoS attack, it is common to employ a mitigation method [8]. As a result, the service capacity is unaffected, leaving service available to legitimate traffic. Future work on our quantum DDoS case could involve developing mitigation methods based on quantum resources.

We illustrate this with a simple method that could be used to develop a more sophisticated strategy. Suppose we have attack Bell states ${|{\beta }_{00}⟩}_{A_1{B}_1}^{(n+1)\tau ,(n+1)\tau }$ and ${|{\beta }_{00}⟩}_{A_2{B}_2}^{(n+1)\tau ,(n+1)\tau }$. The labels $A_1$ and $A_2$ refer to the qubits at the respective attack nodes, and labels $B_1$ and $B_2$ are the qubits that reach the repeater at $t=(n+1)\tau$ (see Appendix A). Under normal conditions, the repeater would perform a projection with the Bell pairs generated at the repeater.

Given that the attack has been detected, the repeater performs a joint projective measurement on the attack qubits themselves, $B_1$ and $B_2$ at $t=(n+1)\tau$. We can write this as

$$\begin{array}{cc}\hfill \mathrm{(45)}& {|{\beta }_{00}⟩}_{A_1{B}_1}^{(n+1)\tau ,(n+1)\tau }\otimes {|{\beta }_{00}⟩}_{A_2{B}_2}^{(n+1)\tau ,(n+1)\tau }\hfill & \hfill =\frac{1}{2}({|{\beta }_{00}⟩}_{A_1{A}_2}^{(n+1)\tau ,(n+1)\tau }\otimes {|{\beta }_{00}⟩}_{B_1{B}_2}^{(n+1)\tau ,(n+1)\tau })\hfill & \\ \hfill \mathrm{(46)}& & +{|{\beta }_{01}⟩}_{A_1{A}_2}^{(n+1)\tau ,(n+1)\tau }\otimes {|{\beta }_{01}⟩}_{B_1{B}_2}^{(n+1)\tau ,(n+1)\tau }\hfill +{|{\beta }_{10}⟩}_{A_1{A}_2}^{(n+1)\tau ,(n+1)\tau }\otimes {|{\beta }_{10}⟩}_{B_1{B}_2}^{(n+1)\tau ,(n+1)\tau }\hfill & \hfill \\ +{|{\beta }_{11}⟩}_{A_1{A}_2}^{(n+1)\tau ,(n+1)\tau }\otimes {|{\beta }_{11}⟩}_{B_1{B}_2}^{(n+1)\tau ,(n+1)\tau }.\hfill & \hfill \end{array}$$

This joint measurement would swap the entanglement to qubits $A_1$ and $A_2$, which are at the attack nodes. Consequently, the Bell pairs generated at the repeater are not used, thereby leaving the repeater’s capacity available for legitimate traffic.

In a large classical network, it is advantageous to devise a traceback method [19] so to identify the source of the attack. Both classical and quantum networks can be modelled as a directed acyclic graphs, where the upstream routers could be viewed as parent nodes and the downstream routes as children nodes. Hence, an interesting direction would be to employ quantum causal models [28] to provide a traceback model for DDoS attacks on a quantum network. The attacks could be formulated in terms of do-interventions and would allow the ability to apply a quantum do-calculus or a quantum causal discovery algorithm to carry out successful traceback for a DDoS attack on a quantum network.

There are a number of ways in which this research could be extended for more practical scenarios. One direction would be to investigate how this entropic detection system could be modified for near-term quantum networks, such as trusted relay networks.

Another research direction would be to explore how this work translates into repeater scenarios involving mixed states. Such cases are of practical importance for quantum networks given channel noise and the imperfections of local devices. One possibility for such modeling is to utilize Werner states for the entanglement swapping protocol and to derive analogous results.

Furthermore, one can consider cases involving multiple repeaters to generate entanglement over farther and farther distances. For such practical cases and where mixed states are employed, the entanglement decreases exponentially with the number of swappings. Finding potential DDoS attacks within such scenarios and designing the associated entropic DDoS detection systems is left for future work.

6. Conclusions

DDoS attacks are a central topic in classical network security and have been identified to be significant threat tp quantum networks. In this work, we designed a quantum analogue of a classical DDoS detection system and applied it in the context of a quantum network. We hope that our design contributes to extending the applicability of quantum information from the domain of data security to area of network security.